Your receipts are your business.

1. Data we collect

We collect the minimum data needed for the app to work. The table below lists every category, why we need it, where it lives, and how long we keep it.

The app requests only these Android permissions: Camera (to photograph receipts), Internet and network state (for optional AI parsing, sign-in, and backup). We do not access your location, contacts, or other apps.

2. How each feature uses your data

Neural Vision Engine (on-device, default)

Receipt text is extracted on your phone using on-device OCR and parsed by a deterministic engine running entirely on your device. No receipt data leaves your phone in this mode.

Smart Bill Engine (cloud AI, opt-in)

If you enable it, a receipt image is sent over an encrypted connection to our secure proxy, which forwards it to Google's Gemini API for parsing (up to 50 scans per month). Your Android ID accompanies the request for quota and abuse prevention. This is off by default and only activates after you explicitly opt in with a clear explanation shown in the app. You can turn it off at any time in Settings. Nortruva Labs does not use your receipt data to train AI models; data sent to Google is governed by Google's API terms.

Sign-in (optional)

You can use the app without an account. If you sign in with email or Google (via Firebase Authentication), we store your account identifiers to keep you signed in and enable backup.

Google Drive backup (optional)

Backups are written to a private AppData folder in your own Google Drive. Only you (and apps you authorize) can read it — Nortruva Labs cannot access your Drive backup.

Widgets & notifications

Home-screen widgets and reminders are generated locally on your device from your local data.

3. What we never do

• We never sell your personal data — not to advertisers, data brokers, or anyone else.
• We never show ads in the app, and we share no data for advertising or cross-context behavioral advertising.
• We use no third-party analytics or tracking SDKs. Spending "insights" are computed on your device from your local data.
• We never read your other apps, messages, location, or contacts.
• We do not use receipt data to build profiles about you for anyone else.

4. Consent & legal bases

We rely on your consent for data processing. Concretely:

• Using the app's core features (scanning a receipt) is itself your consent for on-device processing — described in plain language before you scan.
• Cloud AI parsing requires a separate, explicit opt-in (default off). It is never bundled with the terms of service.
• You can withdraw consent at any time — turn off AI parsing in Settings, delete receipts, or delete your account. Withdrawing is as easy as giving consent.
• Where local law requires a standalone consent notice (e.g., India), we present one before any collection, separate from our terms.

5. Your rights (by region)

No matter where you live, you can access, correct, export, and delete your data. Email privacy@nortruvalabs.com from the address on your account (or use in-app deletion), and we respond within the timelines below. Deleting your account in the app deletes your local data, your Firebase account record, and your server-side quota records; your Drive backup is deleted from your Drive by you.

6. Children's privacy

Mapping Bills is for adults. You must be 18 or older to use the app — this satisfies the strictest rule among our launch countries (India's DPDP Act treats under-18s as children requiring verifiable parental consent, which we do not collect). We do not knowingly collect personal information from children, we do not ask for your date of birth, and the app contains no child-directed content. If you believe a child has provided us data, contact us and we will delete it promptly.

7. Security & breach notification

• Receipt data is stored in an encrypted on-device database; all network traffic uses TLS encryption.
• Our proxy keeps minimal logs (device ID for quota/abuse), retained up to 90 days.
• We use Google's Firebase security controls for authentication data and accept Google's Data Processing Addendum for services we use.

If a data breach occurs, we will notify affected users without undue delay (and within 30 days of discovery as our working rule), notify Quebec's CAI and Canada's OPC promptly where required, and file with India's Data Protection Board within 72 hours of becoming aware, as applicable. We maintain an incident register as required by law.

8. International transfers

Nortruva Labs is based in Canada. When you enable cloud AI parsing or sign in, limited data is processed in the United States via Google services (Firebase Authentication, Gemini API through our proxy).

• Quebec: before any transfer of personal information outside Quebec we complete a privacy impact assessment of the transfer's sensitivity, purposes, and safeguards.
• India: cross-border transfers are permitted under the DPDP Act; no data-localization mandate applies to this app.
• Australia: we take reasonable steps (including Google's contractual data-protection terms) to ensure overseas recipients handle your information appropriately.
• United States: no data-residency restrictions apply to this app's data.

9. Retention

We keep personal data only as long as needed for the purposes above:

• Receipts & parsed data: until you delete them (or delete your account).
• Account identifiers: until you delete your account.
• Drive backups: in your Drive until you delete them.
• Server logs (device ID): up to 90 days.
• Support correspondence: up to 2 years.

When a purpose is fulfilled or consent is withdrawn, we delete the data unless a law requires us to keep it (in which case we tell you).

10. Changes to this policy

We may update this policy as the app or the law changes. Material changes will be announced in the app and the "Effective" date above will be revised. Continued use after changes take effect means you accept the updated policy.